Security at PANOPTIQ
Help keep
PANOPTIQ secure.
Found a security vulnerability in PANOPTIQ? Report it privately. We pay for eligible findings.
- Cash rewards
- NOK 500–15,000 per finding
- Program operator
- PANOPTIQ AS · Norway
Anyone may read these rules or submit a report. No platform account or invitation is required.
01 / Scope
Where you may test
This program covers our websites, applications and APIs at these exact hostnames, using the testing rules below.
panoptiq.aiwww.panoptiq.aistudio.panoptiq.aiworlds.panoptiq.aicdn.panoptiq.aiimages.panoptiq.aijobs.panoptiq.aic.panoptiq.aichttp.panoptiq.aisecurity.panoptiq.aipanoptiq.nowww.panoptiq.nopanoptic.studiowww.panoptic.studiogsplat.cloudwww.gsplat.cloudvolumetric.nowww.volumetric.no
Only the listed hostnames are in scope. A link, redirect, shared IP address or shared owner does not bring another system into scope.
02 / Paid rewards
Clear rewards for confirmed impact
We pay the following amounts in Norwegian kroner for the first eligible report of each previously unknown vulnerability.
| Severity | Example impact | Reward |
|---|---|---|
| Critical | Remote code execution or compromise of the entire service | NOK 15,000 |
| High | Account takeover or unauthorized access to sensitive data | NOK 5,000 |
| Medium | A reproducible security boundary bypass with limited impact | NOK 2,000 |
| Low | A reproducible security issue with minor demonstrated impact | NOK 500 |
We assess severity using demonstrated exploitability, the access required and the effect on confidentiality, integrity and availability. We explain the severity and reward decision in our reply. You may request a reassessment with additional evidence.
Eligibility and payment
- Report a reproducible, previously unknown vulnerability in an in-scope service and follow these rules.
- Include a minimal proof of concept and a clear explanation of the security impact. Stop before causing harm.
- One reward applies per root cause. Duplicate reports and multiple symptoms of the same underlying issue do not receive separate payments.
- Employees, contractors working on the affected system and people involved in creating the vulnerability are not eligible for rewards.
- We pay eligible rewards by bank transfer within 30 calendar days of confirming eligibility and receiving the details needed to make a lawful payment. You are responsible for applicable taxes.
- You may submit under a pseudonym. Payment requires sufficient identity and payment information, and must be permitted by applicable law.
Reports that do not qualify for payment
We do not pay for unverified scanner output, theoretical issues without a working attack, missing headers without demonstrated impact, version disclosures alone, spam, social engineering, denial of service, or issues confined to an out-of-scope system. AI-assisted reports are welcome when you have verified the finding and include reproducible evidence.
03 / Testing rules
Keep testing safe
- Use only accounts, content and data you own or have explicit permission to use.
- Use the fewest requests needed to demonstrate an issue. Do not run bulk scans or bypass rate limits. Stop immediately if you observe unexpected slowdowns, errors or service disruption, and notify us.
- Do not modify or delete other people's data, establish persistence, install malware, or use a finding to move into another system.
- If you encounter personal data, credentials or other confidential information, stop immediately. Do not download more data or attempt further access. Report the location and redact sensitive details.
- Do not phish, impersonate or contact employees, customers or partners as part of testing.
- Keep vulnerability details private for the period in Coordinated disclosure. After that period, you may disclose the issue subject to the data protections below. Do not use extortion or threats.
Authorization for good-faith research
PANOPTIQ AS authorizes good-faith security research on the listed services when it follows this policy. For that research, this policy takes precedence over conflicting testing restrictions in our terms of service.
We will not initiate legal action or request law-enforcement investigation for research that complies with this policy. If a third party takes action, we will clarify that the research was authorized. We cannot authorize activity against another party's systems or waive another party's rights or applicable law.
If you are unsure whether an action is permitted, email us before proceeding.
04 / Reporting
Send us a reproducible report
Email hello@panoptiq.ai with the subject “Security report” and include:
- The affected hostname, URL and a short description of the issue.
- Steps to reproduce using your own accounts and the smallest possible proof of concept.
- The expected behavior, observed behavior and demonstrated security impact.
- Redacted evidence and a way for us to contact you.
Do not email passwords, access tokens or customer data. If evidence is sensitive, describe it first and ask for a secure transfer method.
We aim to acknowledge reports within 5 business days and provide an initial assessment within 10 business days. Remediation depends on severity; we will share progress and coordinate next steps with you.
05 / Coordinated disclosure
Give us time to fix the issue
Please keep vulnerability details private until a fix is available, or for 90 calendar days after your initial report, whichever comes first. We may agree a different disclosure date together. Never include personal data, credentials or customer information in a public disclosure.
We credit researchers only with their permission. You may decline public credit without affecting an eligible reward.
Changes to scope or rewards apply to future research; eligible reports already submitted remain covered by the terms in effect when submitted.